Trust

Security at Cursyv.

Direct, current practice. Formal certifications and a public subprocessor list arrive alongside production billing.

  • Transport encryption

    TLS on every production endpoint we control. No plain-HTTP fallbacks.

  • Least privilege

    Automation keys are scoped narrowly and rotated as we move from preview to paid tiers.

  • Provenance over secrecy

    Every History entry carries a SHA-256 fingerprint. Authorship is verifiable without trusting us.

  • Data residency

    Postgres + RLS on Supabase. Your manuscript rows aren’t readable by other accounts, full stop.

  • Responsible disclosure

    Report anything you find — we respond within two working days and credit reporters on request.

Privacy policyDisclosure email